openship 0.6.6 → 0.6.8

package/dist/{chunk-A4GXYE4L.js → chunk-NIYD7MD2.js}

@@ -9,32 +9,32 @@ import {
   readDeclaredPair,
   readMaybeInContainer,
   validateCertFor
-} from "./chunk-QVW76WDL.js";
+} from "./chunk-IAMOUDHY.js";
 import {
   EDGE_CHALLENGE_HOST_DIR,
   EDGE_CONTAINER_MOUNTS,
   EDGE_HOST_PATHS,
   OPENRESTY_DEFAULT_PATHS
-} from "./chunk-RSR7PFIQ.js";
+} from "./chunk-7PEXM2UI.js";
 import {
   privilegedExecutor,
   rootChecked,
   rootOrDegrade
-} from "./chunk-4I2BM2DT.js";
+} from "./chunk-T46BQOLY.js";
 import {
   envOps,
   opScript
-} from "./chunk-YMMQRE5J.js";
+} from "./chunk-GNOMEMNI.js";
 import {
   resolveEnvironment
-} from "./chunk-UVNMQM7W.js";
+} from "./chunk-NPSRGIHV.js";
 import {
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-P7RCYELG.js";
 import {
-  EDGE_CONTAINER_NAME,
   EdgeConflictError,
   EdgeMigrateRequested,
+  detectEdgeContainer,
   edgeCrashReason,
   edgeFailureReason,
   edgeIsBroken,
@@ -45,25 +45,32 @@ import {
   sanitizeEdgeVhosts,
   sq as sq2,
   stopTargetsForStatus
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-X53JXRS4.js";
+import {
+  waitForPortListening
+} from "./chunk-BO6CY4V2.js";
 import {
+  EDGE_CONTAINER_NAME,
   probeExec,
   tryExec,
-  waitForPortListening,
   withReason
-} from "./chunk-SM26HDS2.js";
+} from "./chunk-D6HU4VUZ.js";
+import {
+  formatDuration,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
 import {
   AppError,
   PROXY_DIRECTIVES,
   answered,
   buildEdgeImageRef,
   compareSemver,
-  formatDuration,
+  isLoopbackHost,
   parseProxyValue,
   safeErrorMessage,
   sanitizeProxySettings,
-  systemDebug
-} from "./chunk-UJ6JZM65.js";
+  shellQuote
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/managed-image.ts
 import { posix } from "path";
@@ -384,9 +391,6 @@ function collapseByHost(items, hostsOf, score) {
   }
   return { kept, dropped };
 }
-function sq3(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
-}
 
 // ../../packages/adapters/src/system/proxy/import/nginx.ts
 async function dumpResolvedConfig(executor, bins) {
@@ -423,8 +427,9 @@ function parseUpstreams(config) {
   let m;
   while ((m = re.exec(config)) !== null) {
     const name = m[1];
-    const server = m[2].match(/(?:^|[\s;{])server\s+([^;\s]+)/);
-    if (name && server?.[1]) map.set(name, server[1].trim());
+    const body = m[2] ?? "";
+    const targets = [...body.matchAll(/(?:^|[\s;{])server\s+([^;\s]+)/g)].map((server) => server[1]?.trim()).filter((target) => Boolean(target));
+    if (name && targets.length > 0) map.set(name, targets);
   }
   return map;
 }
@@ -437,14 +442,55 @@ function resolveProxyTarget(proxyPass, upstreams) {
   const scheme = m[1];
   const authority = m[2];
   const host = authority.replace(/:\d+$/, "");
-  if (upstreams.has(host)) return { url: `${scheme}${upstreams.get(host)}` };
+  const declaredUpstream = upstreams.get(authority);
+  if (declaredUpstream?.[0]) return { url: `${scheme}${declaredUpstream[0]}` };
   const isIp = /^\d{1,3}(\.\d{1,3}){3}$/.test(host);
   if (host === "localhost" || host === "ip6-localhost") {
     return { url: raw.replace(/^(https?:\/\/)[^/:]+/i, "$1127.0.0.1") };
   }
-  if (isIp || host.includes(".")) return { url: raw };
+  if (isIp || host.includes(".") || host.startsWith("[") && host.endsWith("]")) {
+    return { url: raw };
+  }
   return { reason: `proxy_pass host "${host}" is an undeclared upstream \u2014 not migratable` };
 }
+function strictLoopbackUpstreamPorts(config) {
+  const normalized = stripComments(config);
+  const upstreams = parseUpstreams(normalized);
+  const ports = /* @__PURE__ */ new Set();
+  for (const match of normalized.matchAll(/(?:^|[;{}\s])proxy_pass\s+([^;]+);/g)) {
+    const raw = match[1]?.trim();
+    if (!raw) continue;
+    const resolved = resolveProxyTarget(raw, upstreams);
+    if ("reason" in resolved) {
+      if (/\/\/unix:/i.test(raw)) continue;
+      throw new Error(`Cannot inventory Openship edge routes: ${resolved.reason}`);
+    }
+    const authority = raw.match(/^https?:\/\/([^/]+)/i)?.[1];
+    const scheme = raw.match(/^(https?:\/\/)/i)?.[1];
+    const targets = authority && scheme && upstreams.has(authority) ? upstreams.get(authority).map((target) => `${scheme}${target}`) : [resolved.url];
+    for (const target of targets) {
+      let url;
+      try {
+        url = new URL(target);
+      } catch {
+        throw new Error(`Cannot inventory Openship edge routes: invalid proxy_pass "${raw}"`);
+      }
+      if (!isLoopbackHost(url.hostname)) continue;
+      const port = url.port ? Number(url.port) : url.protocol === "https:" ? 443 : 80;
+      if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Cannot inventory Openship edge routes: invalid loopback port in "${raw}"`);
+      }
+      ports.add(port);
+    }
+  }
+  return ports;
+}
+function parseStrictEdgeConfig(raw) {
+  return {
+    ...parseNginxConfig(raw),
+    loopbackUpstreamPorts: strictLoopbackUpstreamPorts(raw)
+  };
+}
 function locationBlocks(serverBody) {
   const out = [];
   const re = /(?:^|[\s;}])location\s+([^{]+?)\s*\{/g;
@@ -536,7 +582,9 @@ function resolveStaticRoot(root, prefix) {
 }
 function parseServer(body, source, upstreams, prefix) {
   const warnings = [];
-  const names = firstDirective(body, "server_name")?.split(/\s+/).filter((n) => n && n !== "_" && !n.startsWith("~") && !LOOPBACK_SERVER_NAMES.has(n.toLowerCase())) ?? [];
+  const names = firstDirective(body, "server_name")?.split(/\s+/).filter(
+    (n) => n && n !== "_" && !n.startsWith("~") && !LOOPBACK_SERVER_NAMES.has(n.toLowerCase())
+  ) ?? [];
   const listens = [...body.matchAll(/(?:^|[;{\s])listen\s+([^;]+);/g)].map((m) => m[1]);
   const ssl = listens.some((l) => /\bssl\b/.test(l) || /\b443\b/.test(l));
   const root = firstDirective(body, "root");
@@ -632,6 +680,35 @@ async function scanOpenshipEdge(executor) {
   const fromContainer = await tryExec(executor, containerCommand(container, cat));
   return parseNginxConfig(fromContainer ?? "");
 }
+async function scanOpenshipEdgeStrict(executor, knownContainer) {
+  const detected = await detectEdgeContainer(executor);
+  if (!detected) {
+    const bareConfig = await dumpResolvedConfig(executor, ["openresty"]);
+    if (bareConfig) return parseStrictEdgeConfig(bareConfig);
+    throw new Error(
+      "Cannot read Openship edge routes: neither Docker nor bare OpenResty inventory is available"
+    );
+  }
+  if (!detected.exists) {
+    const bareConfig = await dumpResolvedConfig(executor, ["openresty"]);
+    if (bareConfig) return parseStrictEdgeConfig(bareConfig);
+    throw new Error(
+      "Cannot read Openship edge routes: no running Openship edge or bare OpenResty inventory is available"
+    );
+  }
+  if (!detected.running) {
+    throw new Error("Cannot read Openship edge routes: the edge container is not running");
+  }
+  const container = knownContainer ?? detected.name;
+  if (!container) throw new Error("Cannot read Openship edge routes: container identity missing");
+  const fromContainer = await executor.exec(
+    containerCommand(container, "openresty -T 2>/dev/null")
+  );
+  if (!fromContainer.trim() || !/server\s*\{/.test(fromContainer)) {
+    throw new Error("Cannot read Openship edge routes: active OpenResty config dump was empty");
+  }
+  return parseStrictEdgeConfig(fromContainer);
+}
 
 // ../../packages/adapters/src/system/proxy/import/caddy.ts
 var CADDYFILE_PATHS = ["/etc/caddy/Caddyfile", "/etc/Caddyfile"];
@@ -907,7 +984,7 @@ async function vhostFilesFromDump(executor) {
 async function loadApacheConfig(executor) {
   const files = await vhostFilesFromDump(executor);
   if (files.length > 0) {
-    const cat2 = await tryExec(executor, `cat ${files.map(sq3).join(" ")} 2>/dev/null`);
+    const cat2 = await tryExec(executor, `cat ${files.map(shellQuote).join(" ")} 2>/dev/null`);
     if (cat2 && cat2.trim()) return cat2;
   }
   const cat = await tryExec(
@@ -1611,6 +1688,24 @@ function makeApi(exec, kind, ours, container) {
     }));
     return scan;
   };
+  let strictLoopbackPorts = null;
+  const listLoopbackUpstreamPortsStrict = (opts = {}) => {
+    if (!ours) {
+      return Promise.reject(
+        new Error("Strict loopback upstream inventory is only available for the Openship edge")
+      );
+    }
+    if (opts.refresh || !strictLoopbackPorts) {
+      const nextScan = scanOpenshipEdgeStrict(exec, container).then(
+        ({ loopbackUpstreamPorts }) => loopbackUpstreamPorts
+      );
+      strictLoopbackPorts = nextScan;
+      void nextScan.catch(() => {
+        if (strictLoopbackPorts === nextScan) strictLoopbackPorts = null;
+      });
+    }
+    return strictLoopbackPorts;
+  };
   const siteFor = async (host) => {
     const target = host.toLowerCase();
     const { sites } = await listSites();
@@ -1642,6 +1737,7 @@ function makeApi(exec, kind, ours, container) {
     ours,
     container,
     listSites,
+    listLoopbackUpstreamPortsStrict,
     sitesByPort: async () => buildProxyRouteIndex((await listSites()).sites),
     siteFor,
     certFor: async (host) => (await certCandidateFor(host)).cert,
@@ -2308,7 +2404,7 @@ function edgeHostExecutor(executor) {
   });
 }
 async function containerEdgeProvider(executor, container, opts) {
-  const { NginxProvider: Provider } = await import("./nginx-KUFMLMAC.js");
+  const { NginxProvider: Provider } = await import("./nginx-4U4C2XUS.js");
   return new Provider({
     ...opts,
     // Vhosts go to the BIND-MOUNTED HOST dir (so every host-side reader — the
@@ -2332,8 +2428,8 @@ async function containerEdgeProvider(executor, container, opts) {
   });
 }
 async function localContainerEdgeProvider(container, opts) {
-  const { DockerEdgeExecutor } = await import("./docker-edge-executor-22IBXNYJ.js");
-  const { NginxProvider: Provider } = await import("./nginx-KUFMLMAC.js");
+  const { DockerEdgeExecutor } = await import("./docker-edge-executor-E5TOTLMR.js");
+  const { NginxProvider: Provider } = await import("./nginx-4U4C2XUS.js");
   return new Provider({
     ...opts,
     paths: OPENRESTY_DEFAULT_PATHS,
@@ -2354,20 +2450,40 @@ async function localContainerEdgeProvider(container, opts) {
     containerEdge: true
   });
 }
-async function startEdgeContainer(executor, container, image, onLog) {
+async function startEdgeContainer(executor, container, image, onLog, mounts) {
   await sanitizeEdgeVhosts(executor, EDGE_HOST_PATHS.sitesDir, onLog).catch(() => {
   });
   await executor.exec(`docker rm -f ${sq(container)} 2>/dev/null || true`).catch(() => {
   });
   const run = await executor.streamExec(
-    buildEdgeRunCommand(container, image),
+    buildEdgeRunCommand(container, image, mounts),
     onLog
   );
   invalidateEdgeContainer(executor);
   return run.code === 0;
 }
-function buildEdgeRunCommand(container, image) {
-  const mounts = EDGE_CONTAINER_MOUNTS.map(
+async function resolveEdgeContainerMounts(executor) {
+  return Promise.all(
+    EDGE_CONTAINER_MOUNTS.map(async (mount) => {
+      let host;
+      try {
+        host = (await executor.exec(`cd ${sq(mount.host)} && pwd -P`)).trim();
+      } catch (err) {
+        throw new Error(
+          `Could not resolve edge bind-mount source ${mount.host} on the target host: ${safeErrorMessage(err)}`
+        );
+      }
+      if (!host.startsWith("/") || host.includes("\n")) {
+        throw new Error(
+          `Could not resolve edge bind-mount source ${mount.host} on the target host: expected one absolute path, received ${JSON.stringify(host)}.`
+        );
+      }
+      return { host, container: mount.container };
+    })
+  );
+}
+function buildEdgeRunCommand(container, image, edgeMounts = EDGE_CONTAINER_MOUNTS) {
+  const mounts = edgeMounts.map(
     // `:z` relabels for SELinux-enforcing hosts; a no-op elsewhere.
     (m) => `-v ${sq(`${m.host}:${m.container}:z`)}`
   ).join(" ");
@@ -2380,10 +2496,27 @@ function buildEdgeRunCommand(container, image) {
     sq(image)
   ].join(" ");
 }
-function makeEdgeStart(executor, container, opts) {
+async function edgeContainerMountsMatch(executor, container, expected) {
+  let raw;
+  try {
+    raw = await executor.exec(
+      `docker inspect -f '{{range .HostConfig.Binds}}{{println .}}{{end}}' ${sq(container)}`
+    );
+  } catch {
+    return null;
+  }
+  const actual = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const [source, destination] = line.trim().split(":");
+    if (!source || !destination) continue;
+    actual.set(destination, source);
+  }
+  return expected.every((mount) => actual.get(mount.container) === mount.host);
+}
+function makeEdgeStart(executor, container, opts, mounts) {
   const { onLog } = opts;
   return async (image) => {
-    if (!await startEdgeContainer(executor, container, image, onLog)) return false;
+    if (!await startEdgeContainer(executor, container, image, onLog, mounts)) return false;
     const verdict = await verifyEdgeServing(executor, container, {
       timeoutMs: opts.verifyTimeoutMs ?? 3e4
     });
@@ -2418,6 +2551,17 @@ async function ensureContainerEdge(executor, opts) {
   const { onLog } = opts;
   const container = opts.container?.trim() || EDGE_CONTAINER_NAME;
   const image = resolveEdgeImage(opts.image);
+  let resolvedMounts = null;
+  const targetMounts = async (checked) => {
+    if (resolvedMounts) return resolvedMounts;
+    const host = checked ?? await rootOrDegrade(executor, {
+      purpose: "Resolving the edge's bind-mount sources",
+      consequence: "Docker may mount a different host directory than Openship writes.",
+      report: (message) => onLog(log5(message, "warn"))
+    });
+    resolvedMounts = await resolveEdgeContainerMounts(host);
+    return resolvedMounts;
+  };
   const existing = await resolveOurEdgeContainer(executor, { fresh: true });
   if (existing) {
     const verdict = await verifyEdgeServing(executor, existing);
@@ -2425,27 +2569,35 @@ async function ensureContainerEdge(executor, opts) {
       onLog(log5(`The edge container exists but isn't serving: ${verdict.reason}`, "warn"));
       onLog(log5("Recreating it...", "warn"));
     } else {
-      const current = await containerImageRef(executor, existing);
-      const stale = current != null && current !== image;
-      if (stale) {
-        const start = makeEdgeStart(executor, existing, opts);
-        const swap = await swapManagedImage(executor, {
-          kind: "edge",
-          from: current ?? image,
-          to: image,
-          label: "edge",
-          onLog,
-          start
-        });
-        return {
-          container: existing,
-          image,
-          converted: false,
-          updated: swap.swapped,
-          edgeDown: swap.down
-        };
+      const mounts2 = await targetMounts();
+      const mountsMatch = await edgeContainerMountsMatch(executor, existing, mounts2);
+      if (mountsMatch === false) {
+        onLog(
+          log5("The edge container uses stale or non-canonical bind mounts; recreating it...", "warn")
+        );
+      } else {
+        const current = await containerImageRef(executor, existing);
+        const stale = current != null && current !== image;
+        if (stale) {
+          const start = makeEdgeStart(executor, existing, opts, mounts2);
+          const swap = await swapManagedImage(executor, {
+            kind: "edge",
+            from: current ?? image,
+            to: image,
+            label: "edge",
+            onLog,
+            start
+          });
+          return {
+            container: existing,
+            image,
+            converted: false,
+            updated: swap.swapped,
+            edgeDown: swap.down
+          };
+        }
+        return { container: existing, image, converted: false };
       }
-      return { container: existing, image, converted: false };
     }
   }
   if (!await dockerAvailable(executor)) {
@@ -2480,10 +2632,11 @@ async function ensureContainerEdge(executor, opts) {
       );
     });
   }
+  const mounts = await targetMounts(hostState);
   const clear = await ensureEdgeClear(executor, opts.config, onLog);
   try {
     onLog(log5("Starting the edge container..."));
-    if (!await startEdgeContainer(executor, container, image, onLog)) {
+    if (!await startEdgeContainer(executor, container, image, onLog, mounts)) {
       throw new Error("the edge container failed to start");
     }
     const verdict = await verifyEdgeServing(executor, container, {
@@ -2533,6 +2686,7 @@ export {
   resolveEdgeImage,
   containerEdgeProvider,
   localContainerEdgeProvider,
+  resolveEdgeContainerMounts,
   buildEdgeRunCommand,
   verifyEdgeServing,
   ensureContainerEdge,

package/dist/{chunk-UVNMQM7W.js → chunk-NPSRGIHV.js}

@@ -4,18 +4,20 @@ import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
 import {
   sq
-} from "./chunk-ZFJXPCQP.js";
+} from "./chunk-P7RCYELG.js";
 import {
-  assessHostSupport,
-  classifyDistro,
   formatDuration,
   isRemoteConnectionError,
+  systemDebug
+} from "./chunk-N5YZMO33.js";
+import {
+  assessHostSupport,
+  classifyDistro,
   parseOsRelease,
   parseSystemArch,
   parseSystemOs,
-  safeErrorMessage,
-  systemDebug
-} from "./chunk-UJ6JZM65.js";
+  safeErrorMessage
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/elevated-executor.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-2GWYYHOR.js → chunk-NRU2EBYZ.js}

@@ -13,11 +13,11 @@ var CloudInfraProvider = class {
   async registerRoute(route) {
     void route;
   }
-  async removeRoute(domain) {
+  async removeRoute(domain, _opts) {
     void domain;
   }
   // ── SSL ──────────────────────────────────────────────────────────────
-  async provisionCert(domain) {
+  async provisionCert(domain, _opts) {
     return { domain, expiresAt: "", issuer: "oblien", verified: false };
   }
   async renewCert(domain) {

package/dist/{chunk-CBLD2HS5.js → chunk-NUT6HKK6.js}

@@ -19,13 +19,16 @@ import {
   rollbackEdgeTakeover,
   scanImportableSites,
   unreachableStaticRoots
-} from "./chunk-A4GXYE4L.js";
+} from "./chunk-NIYD7MD2.js";
 import {
   LocalExecutor
-} from "./chunk-6FH4AXVY.js";
+} from "./chunk-T6DVUX4F.js";
 import {
   ourEdgeContainerRunning
-} from "./chunk-2YM3NI2E.js";
+} from "./chunk-X53JXRS4.js";
+import {
+  isOurEdgeContainer
+} from "./chunk-D6HU4VUZ.js";
 
 // src/lib/edge-preflight.ts
 import { spawnSync } from "child_process";
@@ -195,7 +198,7 @@ async function diagnoseEdge() {
   } catch {
     return { ...empty, containerExists: exists, containerRunning: running };
   }
-  const foreignOccupants = status.occupants.filter((o) => o.containerName !== "openship-edge");
+  const foreignOccupants = status.occupants.filter((o) => !isOurEdgeContainer(o.containerName));
   const hostProxySquatting = !running && foreignOccupants.some((o) => !o.containerName);
   let sites = [];
   if (status.occupants.length > 0) {
@@ -240,7 +243,7 @@ async function repairEdgeConflict(mode, apiPort, onLog) {
   }
   spawnSync("docker", ["restart", "openship-edge"], { stdio: "ignore" });
   if (mode === "migrate" && scan.sites.length > 0) {
-    const { importMigratedSites } = await import("./edge-import-WJUB4M7F.js");
+    const { importMigratedSites } = await import("./edge-import-YJVJUGYC.js");
     const outcome = await importMigratedSites(apiPort, scan.sites, certPems);
     if (outcome.registered.length === 0) {
       return {

package/dist/{chunk-ZFJXPCQP.js → chunk-P7RCYELG.js}

@@ -2,6 +2,9 @@
 ":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
 import { createRequire as __ospCreateRequire } from "node:module";
 const require = __ospCreateRequire(import.meta.url);
+import {
+  shellQuote
+} from "./chunk-WEZFTL4V.js";
 
 // ../../packages/adapters/src/system/local-shell.ts
 import { execFile } from "child_process";
@@ -28,9 +31,7 @@ var LOCAL_BUILD_ENV_KEYS = [
   "XDG_CACHE_HOME",
   "XDG_DATA_HOME"
 ];
-function sq(value) {
-  return `'${value.replace(/'/g, "'\\''")}'`;
-}
+var sq = shellQuote;
 function logEntry(message, level = "info", rawData) {
   return { timestamp: (/* @__PURE__ */ new Date()).toISOString(), message, level, ...rawData ? { rawData } : {} };
 }

package/dist/chunk-R4VDPFLS.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env sh
+":" //# ; exec "$(command -v node || command -v bun)" "$0" "$@"
+import { createRequire as __ospCreateRequire } from "node:module";
+const require = __ospCreateRequire(import.meta.url);
+
+// ../../packages/adapters/src/system/reachability.ts
+import { connect } from "net";
+import { request } from "http";
+function classifyDialError(code) {
+  switch (code) {
+    case "ECONNREFUSED":
+    case "ECONNRESET":
+      return "refused";
+    case "ENOTFOUND":
+    case "EAI_AGAIN":
+      return "unresolved";
+    case "EHOSTUNREACH":
+    case "ENETUNREACH":
+    case "ENETDOWN":
+      return "no_route";
+    // The kernel's own connect timeout, i.e. our `timeout` reported for us.
+    case "ETIMEDOUT":
+      return "timeout";
+    default:
+      return "error";
+  }
+}
+function probeTcpDetailed(host, port, timeoutMs = 2500) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (result, socket2) => {
+      if (settled) return;
+      settled = true;
+      try {
+        socket2?.destroy();
+      } catch {
+      }
+      resolve(result);
+    };
+    const socket = connect({ host, port });
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => done({ ok: true }, socket));
+    socket.once(
+      "timeout",
+      () => done({ ok: false, reason: "timeout", message: `no response within ${timeoutMs}ms` }, socket)
+    );
+    socket.once("error", (err) => {
+      const errno = err;
+      done(
+        {
+          ok: false,
+          reason: classifyDialError(errno.code),
+          ...errno.code ? { code: errno.code } : {},
+          ...errno.message ? { message: errno.message } : {}
+        },
+        socket
+      );
+    });
+  });
+}
+function probeHostedHttp(opts) {
+  const { hostname, path = "/", port = 80, timeoutMs = 3e3 } = opts;
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
+    const req = request(
+      {
+        host: "127.0.0.1",
+        port,
+        path,
+        method: "GET",
+        timeout: timeoutMs,
+        // Claim https so the :80 block SERVES instead of answering our own
+        // HTTP→HTTPS redirect before the doc root is consulted — see the curl twin in
+        // output-exists.ts for why a 301 here read as a healthy site.
+        headers: { Host: hostname, "X-Forwarded-Proto": "https" }
+      },
+      (res) => {
+        const status = res.statusCode ?? 0;
+        res.resume();
+        done(
+          status > 0 ? { status, served: status >= 200 && status < 400 || status === 401 || status === 403 } : null
+        );
+      }
+    );
+    const fail = () => {
+      try {
+        req.destroy();
+      } catch {
+      }
+      done(null);
+    };
+    req.once("timeout", fail);
+    req.once("error", fail);
+    req.end();
+  });
+}
+
+export {
+  probeTcpDetailed,
+  probeHostedHttp
+};

package/dist/{chunk-HKRQXPTI.js → chunk-R5DC5PEF.js}

@@ -7,7 +7,7 @@ import {
   COMPONENT_INSTALLERS,
   checkAll,
   checkComponents
-} from "./chunk-A4GXYE4L.js";
+} from "./chunk-NIYD7MD2.js";
 
 // ../../packages/adapters/src/system/state.ts
 var DEFAULT_STATE_PATH = "/etc/openship/setup-state.json";